ABA CERP Exam 2026: Domain Weights, Score Rules, and What It Costs

TL;DR

• Risk Responses (18%) + Risk Monitoring (16%) = 34% of the exam. Study those first.
• Passing score is 500 on a 200-800 scaled score, you cannot back-calculate a raw percentage target.
• $815 to sit, $500 to retake; you must pass within 3 years of your first attempt.
• Renewal requires 60 CE credits per 3-year cycle plus an annual fee.
• BCBS 239 and COSO ERM recur across multiple domains; they repay more study time than any single-domain reference.
• Scenario-based application questions are the format, judgment under described conditions, not definition recall.

What the Official 2026 Eight-Domain Outline Actually Weighs#

The CERP is not eight equal slices. The official 2026 exam outline assigns specific weights that span from 7% to 18%, and treating the exam as if it's evenly distributed is the single fastest way to misprepare.

Risk Responses and Risk Monitoring together account for 34% of the exam. Control Framework and Board Oversight together account for 15%. That's a 19-percentage-point gap between the two heaviest and two lightest domains. A flat study plan, equal time to all eight domains, leaves you underprepared where the exam weights most heavily and overprepared in territory that generates fewer than one in ten questions.

The weights were confirmed current as of March 11, 2026. Older versions of the study resource PDF circulate online and show different distributions. If your study materials cite different weights, you're working from an outdated outline.

Who Qualifies: Two Eligibility Tiers Before You Pay Anything#

Official eligibility criteria structure CERP candidacy around two tiers, both of which require U.S.-based work experience in banking risk management. You purchase the exam first and then submit the application. If the application is denied, you get your exam fee back minus a $100 application fee, so you'll want to check the eligibility rules before you pay.

Official eligibility criteria define which job roles qualify and which are explicitly excluded. Candidates in roles that primarily involve execution rather than risk oversight or management may find themselves in a gray zone. Read the official eligibility criteria line by line before applying; this is not an exam where you want to discover a problem after the application fee has been processed.

The Full Cost: $815 to Sit, $500 to Retake, and 60 CE Credits Every Three Years#

The exam application fee is $815. A retake costs $500. Those are the numbers most candidates focus on, but the real cost structure runs longer.

Once certified, the CERP is valid for three years. Renewal requires 60 continuing education credits per three-year cycle plus an annual fee. The ongoing CE commitment is worth modeling before you sit, as sixty credits over three years is about 20 per year, not a burden, but not free either, particularly at banks where professional development budgets are tight.

How a 200-800 Scaled Score and Unscored Pilot Items Affect Your Result#

The CERP doesn't score on raw percentage. The passing mark is 500 on a 200-800 scaled score. Scaled scoring adjusts for exam form difficulty, which means you cannot back-calculate a target raw score with any precision. The only target that matters is 500 on the scale.

The 200-question total includes a small number of unscored pilot items embedded throughout. You cannot identify them during the exam. Every question presents as live, and none are labeled as experimental. The practical implication: don't guess which questions are pilots and mentally discount them. Treat every question as scored.

Time-Pressure Math#

240 minutes for 200 questions works out to 72 seconds per question. That's tight for scenario-based application questions, which are the format official documentation describes. Scenario questions require reading a multi-sentence case before evaluating four answer choices, and at 72 seconds each there's almost no slack in the time budget.

The right approach is straightforward: read once deliberately, mark anything genuinely uncertain for review, and move. Spending three minutes on one hard question costs you time on four easier ones. The exam won't tell you how much time remains per question, you'll need to track pace yourself.

The Regulatory Documents Assigned to Multiple Domains#

Several regulatory documents recur across multiple domains in the exam outline. These are the references that repay the most time because they're tested throughout the exam, not just in one section.

BCBS 239 (Principles for Effective Data Aggregation and Risk Reporting) is an officially assigned reference for both Domain 3 (Management Information Systems) and Domain 8 (Risk Monitoring). Understanding it covers roughly 27% of the exam's weight across those two domains alone.

COSO Enterprise Risk Management (2004 framework and 2017 update) runs through Domains 1, 2, 5, and 7. That's 53% of the exam. The 2017 update specifically integrates ERM with strategy and performance, a conceptual shift that shows up in governance and risk response questions.

SR 11-7 (Federal Reserve's Model Risk Management guidance) is assigned to Domains 2 and 6. Anyone who has worked in model validation will recognize the concepts; those who haven't should read the letter before exam day.

OCC Comptroller's Handbooks are assigned across Domains 2, 5, 6, and 7, the four domains that together constitute 58% of the exam. Multiple handbooks are relevant: Interest Rate Risk, Liquidity, Credit Risk, and Third-Party Relationships all appear in the official domain notes. The handbooks are free PDF downloads from the OCC website, which makes them one of the higher-value resources available at no cost.

The Five Heaviest Domains: What Each One Actually Tests#

Domain 7, Risk Responses (18%)#

18%

The exam tests which of the four response types (accept, mitigate, transfer, avoid) is appropriate given a specific risk profile and risk appetite statement. Getting that judgment wrong under exam conditions is common, particularly when the scenario makes mitigation look obvious but accept or transfer is the better fit for the described institution's risk tolerance.

Issue management is the other half of this domain. The lifecycle runs from identification through tracking, resolution, validation, and closure. Each step has defined requirements, and the exam probes whether candidates understand the difference between resolving an issue and validating that the resolution was effective. OCC Bulletin 2014-52 governs MRA guidance and is explicitly referenced in the domain notes.

Domain 8, Risk Monitoring (16%)#

16%

This domain tests whether you can design what should be monitored, not just report what happened. The KRI versus KPI versus KCI distinction trips candidates who have used these terms loosely in practice. The exam holds them to precise definitions: a Key Risk Indicator signals future risk, a Key Performance Indicator measures performance against objectives, and a Key Control Indicator measures how well a control is operating. Conflating them in scenario questions produces wrong answers.

BCBS 239 governs the data aggregation side of this domain. Dashboard design, color coding, heat mapping, and escalation path logic all appear in the task list. The monitoring cycle must close back into the broader risk management process, questions that test this loop show up here.

Domain 5, Risk Identification (15%)#

15%

RCSA methodology sits at the center of this domain. The exam distinguishes between inherent risk (the risk before controls) and residual risk (the risk after controls), and scenario questions require candidates to apply that distinction correctly to scoping decisions.

Third-party risk identification is a significant sub-topic. OCC Bulletin 2013-29 on Third-Party Relationships is referenced in the official notes. Concentration risk, when a single vendor, counterparty, or activity represents a disproportionate share of exposure, is separately testable. Upstream and downstream impact assessment rounds out the domain; candidates who understand only direct risk identification and not second-order effects will lose points here.

Domain 6, Risk Measurement and Evaluation (13%)#

13%

The official exam outline appendix lists specific risk measures for this domain, and the exam uses them. On the credit side: probability of default (PD), loss given default (LGD), exposure at default (EAD), expected loss, and the Allowance for Loan and Lease Losses (ALLL). On the financial side: Value at Risk (VaR), net interest income (NII) versus economic value of equity (EVE) for interest rate risk, and the liquidity coverage ratio.

Stress testing and scenario analysis are explicitly in scope. The exam tests fundamentals and limitations, knowing that stress testing has blind spots is as testable as knowing how to run one. DFAST guidance and Basel III liquidity standards are referenced alongside Jorion's Value at Risk.

A common slip in this domain: candidates confuse VaR with stress testing. VaR estimates loss under normal market conditions at a given confidence interval; stress testing models losses under severe but plausible scenarios that VaR explicitly does not capture. The exam probes that boundary.

Domain 2, Policies, Procedures, and Limits (12%)#

12%

This domain is where risk appetite becomes operational. The exam tests how qualitative appetite statements translate into quantitative policy limits, how exceptions get documented and approved, and what happens when a breach occurs. The escalation and tracking requirements for policy breaches are specifically listed in the task outline.

OCC Heightened Standards (12 CFR 30) is a named reference for this domain. Candidates at smaller institutions who haven't operated under Heightened Standards should read the relevant guidance before the exam, it sets expectations that show up in policy and governance questions.

Forgetting that appetite must translate to numeric limits is the domain's most common error. A qualitative statement ("we have a low tolerance for credit concentration") is not a policy limit. The exam distinguishes between them sharply.

How to Allocate Your Study Time#

Official documentation provides no recommended study hours; any hour counts from other sources are estimates rather than official figures. The one planning input the exam outline does give you is the domain weighting: allocate study time by domain weight, not alphabetically or in domain order. Domains 7, 8, and 5 together represent 49% of the exam, so get those right first.

Study Resources in Priority Order#

The CERP has fewer third-party resources than most professional certifications. The available materials fall into a clear priority sequence.

Start here:

1. CertCompanion practice questions at /exams/aba-certified-enterprise-risk-professional-cerp: work through practice questions before reading regulatory documents to identify knowledge gaps first. Aim for 80-90% on the heavier domains before scheduling.
2. Official CERP Exam Outline and Study Resource Guide (PDF): the task-level breakdown for all eight domains, including recommended regulatory references per domain and the full appendix of key risk measures. Use it as your domain checklist once you know where your gaps are.

Regulatory reading by domain weight:

• COSO ERM 2017 (Domains 1, 2, 5, 7–53% of exam): Read before Domains 7 and 5 in particular; governance and identification questions draw directly from it.
• OCC Comptroller's Handbooks (Domains 2, 5, 6, 7–58% of exam): Prioritize Interest Rate Risk, Liquidity, Credit Risk, and Third-Party Relationships. Free PDF downloads.
• BCBS 239 (Domains 3, 8–27% of exam): Concise document; read it fully before studying Domain 8.
• SR 11-7 (Domains 2, 6–25% of exam): Federal Reserve model risk guidance; read before Domain 6 scenario practice.

Supplementary:

• Official sample questions: limited in number but set the format baseline.
• Official prep course: covers all eight domains but some candidates report it may lag current exam content. Treat it as a domain survey, not a sufficient standalone resource. Official guidance indicates that completing the course does not guarantee passing, so use it as one input among several rather than a sole preparation resource.

For all ABA certification content in one place, the /exams/provider/aba hub lists every ABA credential.

Reasoning Through a CERP Question#

The CERP's scenario questions test your ability to apply framework knowledge to a specific institutional situation, not recall definitions. The question below, drawn from our practice bank, illustrates exactly this skill: given a defined organizational structure and a named framework, which activity falls within a specific function's appropriate scope?

Contoso Financial's internal audit team is scoping its annual review of the enterprise risk management framework. Under the IIA's Three Lines Model, which activity falls within internal audit's appropriate scope of responsibility? (Select one!)

• A. Developing and implementing risk appetite limits for the consumer lending portfolio
• B. Performing independent validation of the bank's credit scoring models
• C. Designing and executing Risk and Control Self-Assessments for operational risk in the trading division
• D. Providing independent assurance on the adequacy and effectiveness of the overall risk governance framework

Show the answer and the reasoning

Correct answer: D. Providing independent assurance on the adequacy and effectiveness of the overall risk governance framework

Under the IIA's Three Lines Model, internal audit, the third line, provides independent, objective assurance and advice on the adequacy and effectiveness of governance, risk management, and control processes. This includes assessing whether the overall risk governance framework functions properly, risk policies are being followed, and the first and second lines are operating effectively. Independent model validation is a second-line function performed by the model risk management team, not internal audit. Developing and implementing risk appetite limits is a second-line risk management function in collaboration with senior management and the board. Designing and executing RCSAs is a first-line responsibility with second-line oversight, not a third-line activity. Internal audit may assess whether RCSAs are conducted effectively but does not execute them.

The common mistake this question exposes is conflating the second line's oversight function with internal audit's independent assurance function. Candidates who learned "three lines of defense" as a diagram but not as a set of functional boundaries, with clear separations between them, will select an answer that blurs the lines. The IIA's Three Lines Model is a named reference in the CERP outline for exactly this reason.

Practice Questions and What the Official Samples Reveal About Question Style#

The official sample questions are the clearest signal of what exam day looks like. They're scenario-based and application-level, not definition recall. A typical question presents a bank's situation, a decision or finding, then asks which response, classification, or action best fits the described circumstances.

CertCompanion's practice bank at /exams/aba-certified-enterprise-risk-professional-cerp contains 749 questions with detailed explanations, 21% are select-all-that-apply format, and the median explanation runs 119 words. Start with the free questions before scheduling your exam; the feedback on wrong answers matters more than the question count. Aim for consistent scores in the 80-90% range across the heavier domains before you book a seat.

Official free practice questions are available as supplementary material. These are limited in number but set the baseline for question difficulty and scenario format expected on exam day.

Some candidates report that the official prep course alone was not sufficient preparation. Official guidance indicates that completing the course does not guarantee passing, so treat it as one input among several rather than a sole preparation resource.

The 3-Month Retake Rule and the 3-Year Attempt Window#

Two hard constraints limit your options if you need to retake. First, candidates must wait a minimum of 3 months between the start dates of exam windows, and a $500 retake fee applies. Second, you must pass within three years of your first attempt. If the three-year window closes without a passing score, you don't carry forward. The clock on that window starts at your first attempt, not your application date.

The next confirmed exam window is February 1-28, 2027, with an application deadline of December 4, 2026. The exam is administered in monthly testing windows. Missing an application deadline means waiting for the next window, which affects your planning if you're working toward a target date for a performance review or promotion cycle.

The 3 months are counted from the start date of your most recent window to the start date of the retake window, not from the day you tested. Official guidance gives this example: if your window starts February 1, the earliest retake is a window starting on or after May 1. On the 2027 calendar that would mean a February attempt can be retaken in the June window, not April.

Meazure Learning Centers or Live Remote Proctoring: How the Testing Windows Work#

The CERP uses Meazure Learning as its testing provider. Two delivery modes are available: U.S.-based test centers and live remote proctoring (LRP) from a qualifying location.

LRP is a real option for candidates who don't live near a Meazure Learning center or who prefer the convenience of testing from home or office. The proctoring is live, not recorded-only, which means the technical and environmental requirements matter, a failed proctoring session due to a connectivity issue or an unsecured environment is not the same as a failed exam attempt, but it's a disruption nobody wants on exam day.

The testing window means you register for a specific calendar month, not a specific date. Within that window you schedule your actual appointment. The February 2027 window runs February 1-28, apply by December 4, 2026 if that's your target.

After You Pass#

Earning the CERP signals credentialed competence in U.S. bank risk management to employers and examiners who recognize the credential.

What comes after the CERP depends on where your career is heading, and ABA prescribes no sequence.

Maintenance requires 60 CE credits over three years plus an annual fee. Official resources include a CE database for tracking credits, which reduces the administrative overhead of logging activities across multiple providers.

Frequently Asked Questions#

Does the certification body publish a pass rate for the CERP? Official documentation does not publish pass rate data for the CERP. Focus on hitting 500 on the 200-800 scale, that's the only benchmark that matters.

What happens if I don't pass within the three-year window? If you don't earn a passing score within three years of your first attempt, your eligibility for that application cycle ends. You would need to apply again, pay the application and exam fees, and start the clock over. The three-year window is a hard limit, not a soft guideline.

Do the unscored pilot items count against me? No. Pilot items are embedded to gather statistical data for future exam forms and are not counted in your score. But you can't identify them during the exam, and there's no practical reason to try. Every question should get your full attention.

How do I log CE credits after passing? Official resources include a CE database for certified credential holders. Credits can come from a range of qualifying activities, including official programs, other professional development, and activities that meet the CE criteria. The requirement is 60 credits per three-year cycle, plus an annual fee to maintain active status.

What happens to my fee if my application is denied? You pay the $815 exam fee when you purchase the exam, then submit the application. If the application is denied, the exam fee is refunded minus a $100 application fee.

What question style should I expect on exam day? Official exam documentation describes scenario-based application questions with four answer choices. You'll read a brief case describing a bank's situation and select the best response, classification, or action. Questions are designed to test judgment and application, not definitions or memorization.

Can I take the CERP if I work for a regulatory agency? Bank examiner roles at regulatory agencies appear in the list of roles that may qualify. Official eligibility criteria specify U.S.-based experience in banking risk management. Verify your specific role against the current eligibility criteria on the official certification page before applying.

The CERP is a banking-specific credential with a clear structure: eight domains at known weights, a 200-800 scaled score, $815 to sit, and a three-year cycle with ongoing CE obligations. Preparation that ignores the weight distribution is preparation misallocated. Risk Responses at 18% and Risk Monitoring at 16% are where the exam concentrates, your study time and your retake strategy should both reflect that.

Work through our aligned practice questions at CertCompanion and see where your domain-by-domain scores stand before you book your seat.

Checked against official ABA CERP exam documentation. Last verified 2026-11-02.